---
id: "CVE-2026-98921"
kind: "vulnerability"
aliases: ["CVE-2026-98921"]
title: "Linux kernel: overlayfs debug print reads freed dentry during mkdir"
severity: "unknown"
cvss: null
epss: 0.00198
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["containers", "linux-kernel", "overlayfs", "runtime"]
not_affected_if: ["default-config", "no-overlay-debug"]
published_at: "2026-10-23T13:17:12+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98921", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98921", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: overlayfs debug print reads freed dentry during mkdir

In the Linux kernel's overlay filesystem, a debug print in the mkdir path reads the input dentry after vfs_mkdir() may have released it. This is a use-after-free that only occurs when the kernel is built with CONFIG_OVERLAY_FS_DEBUG enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the kernel is built with `CONFIG_OVERLAY_FS_DEBUG` (for example `grep CONFIG_OVERLAY_FS_DEBUG /boot/config-$(uname -r)`)
- Check the running kernel version with `uname -r` and compare it to the fixed kernel in your distribution's advisory

## Fix

- Update to a Linux kernel release or distribution kernel package that includes the fix for ovl_do_mkdir() debug print (the sources do not name a specific version)
- Rebuild without `CONFIG_OVERLAY_FS_DEBUG` if you do not need overlayfs debug output (unknown whether the sources recommend this)

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98921
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98921

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovl_do_mkdir() debug print

ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir().
Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on
failure."), vfs_mkdir() calls end_creating() on the input dentry on
failure and may replace it on success, so the post-call %pd can
use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.

Print the dentry before the call and only the result afterward.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_